Fine · France
FREE MOBILE: EUR 27,000,000
- Authority
- Commission nationale de l'informatique et des libertés (CNIL)
- Country
- France
- Date
- Decision of 8 January 2026
- Amount
- EUR 27,000,000, as imposed (not converted)
- Appeal status
- Unknown
- Provisions cited
- Article 32, Article 34, Article 5(1)(e)
What the fine was for (summary, not the official text)
After an October 2024 intrusion exposed 24 million subscriber contracts (including IBANs): weak VPN authentication and poor detection, an incomplete breach notice to subscribers, and excessive retention of former subscribers' data.
Checked against the official source on 28 October 2026.
Only the authority's decision is authoritative. This is reference material, not legal advice.